Cryptology ePrint Archive: Report 2021/930

Darlin: A proof carrying data scheme based on Marlin

Ulrich Haböck and Alberto Garoffolo and Daniele Di Benedetto

Abstract: In this document we describe the Darlin proof carrying data scheme for the distributed computation of block and epoch proofs in a Latus sidechain of Zendoo (IACR eprint 2020/123). Recursion as well as base proofs rest on Marlin using the Pasta cycle of curves and the ‘dlog’ polynomial commitment scheme introduced by Bootle et al. EUROCRYPT 2016. We apply the amortization technique from Halo (IACR eprint 2019/099) to the non-succinct parts of the verifier, and we adapt their strategy for bivariate circuit encoding polynomials to aggregate Marlin’s inner sumchecks across the nodes of the proof carrying data scheme. Regarding performance, the advantage of Darlin over a scheme without inner sumcheck aggregation is about 30% in a tree-like scenario as ours, and beyond when applied to linear recursion.

Category / Keywords: cryptographic protocols / R1CS, SNARKs, Aggregation schemes

Date: received 8 Jul 2021, last revised 10 Jul 2021

Contact author: ulrich at horizenlabs io,alberto@horizenlabs io,daniele@horizenlabs io

Available format(s): PDF | BibTeX Citation

Note: Corrected the references for Halo 2 and the Pasta Curves

Version: 20210710:072540 (All versions of this report)

Short URL:

[ Cryptology ePrint archive ]